如何提供 JAD OTA 链接的防盗链方法
好的，我目前正在 PHP 中使用下载脚本，该脚本查询 mySQL 数据库并检查该令牌是否已下载（该令牌是我通过生成脚本手动创建的）。例如，我的生成链接将是 http://www.mysite.com/ota /download.php?id=6gs78sj39h3e
我有正确的标头来允许正确的 OTA 下载并且脚本正常运行...但是这是我担心的...如果用户不使用他/她的移动设备下载 JAD 文件，然后使用浏览器，浏览器会显示另存为对话框。如果用户下载提供的文件，该文件的名称为 download.php，内容为 JAD 文件。该 jad 文件中包含指向 .cod 文件的链接。
例如，如果我生成的链接是 http://www.mysite.com/ota/ download.php?id=6gs78sj39h3e 如果他们在文本编辑器中打开这个 jad 文件，任何有 2 美分的人都会知道“MYAPP-1.cod” 驻留在 /ota/ 目录中，然后可以继续下载所有 *.cod 文件，并有机会在其他地方提供此下载...
防止这种情况的最佳方法是什么？我想可能检查一下他们是否使用黑莓浏览器，如果没有拒绝链接，以及他们是否继续下载，但我很确定如果你真的想要的话，你可以“伪造”浏览器标识......所以任何有关如何更好地完成提供 JAD 下载而又不允许用户查看 JAD 文件内容的建议？
Ok, I am currently using a download script in PHP which queries a mySQL database and checks if that token has been downloaded (this token I create manually through a generate script). So for example my generate link would be http://www.mysite.com/ota/download.php?id=6gs78sj39h3e
I have the proper headers to allow for a correct OTA download and the script functions properly...however this is my concern....If a user does not use his/her mobile device to download the JAD file and instead use's a browser the browser presents a save as dialogue. If the user downloads the file offered it is named as download.php and the contents are of the JAD file. Within this jad file are links to the .cod files.
For example if my generated link was http://www.mysite.com/ota/download.php?id=6gs78sj39h3e
If they opened this jad file in a text editor anyone with 2 cents will know that "MYAPP-1.cod"
resides within the /ota/ directory and then can proceed to download all of the *.cod files and have the opportunity to offer this download elsewhere...
What is the best approach to prevent this? I was thinking possibly checking to see if they are using a blackberry browser and if not deny the link and if they are proceed to download but I am pretty sure you can 'fake' the browser identification if you really wanted....So any suggestions on how to better accomplish offering a JAD download without allowing the users to view the contents of the JAD file?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
冒着说出来的风险，你实际上没有任何选择：你应该对黑莓浏览器进行用户代理检查，因为对于不习惯使用浏览器用户代理的更随意的用户来说，这将是可行的，但对于任何人来说谁有奉献精神，他们就能克服它。
最有用的可能是在一定时间后自动使链接过期：生成不仅指向 JAD 文件而且还指向 COD 文件的链接，然后使这些链接在一两天后过期。至少会减少链接被重新分发或他们知道 COD 文件具体位置的机会。但不确定这将如何与黑莓安装程序一起使用。
At the risk of saying it you don't really have any options: you should do the user-agent check for the Blackberry browser because for the more casual user who is not used to playing with browser user agents that will work, but for anyone who is dedicated they'll be able to get around it.
What is probably most useful is to automatically expire the links after a certain time: generate a link to not only the JAD file but to the COD files as well and then make those links expire after a day or two. Will at least reduce the chance that the links get redistributed or that they know specifically where the COD files are. Not sure how that will work with the Blackberry installer though.